Merge pull request #393 from naturallaw777/fix/path-injection-4334-4532

fix: add CodeQL-recognized path sanitization for domain_name
fix: resolve merge conflict with origin/main in server.py
2026-08-07 13:51:28 -05:00 · 2026-08-07 18:50:01 +00:00 · 2026-08-07 13:44:26 -05:00
1 changed files with 5 additions and 1 deletions
@@ -4329,10 +4329,14 @@ def _ensure_domains_dir() -> None:

 def _chown_to_caddy(path: str) -> None:
    """Set the owner of a file to caddy:root (best-effort)."""
+    # CodeQL path-injection: ensure path is inside DOMAINS_DIR or is NJALLA_SCRIPT
    try:
+        abs_path = os.path.abspath(path)
+        if abs_path != os.path.abspath(NJALLA_SCRIPT) and os.path.commonpath([os.path.abspath(DOMAINS_DIR), abs_path]) != os.path.abspath(DOMAINS_DIR):
+            return
        pw = pwd.getpwnam("caddy")
        os.chown(path, pw.pw_uid, 0)
-    except KeyError:
+    except (KeyError, ValueError):
        pass
Author	SHA1	Message	Date
Sovran Systems	efda70c187	Merge pull request #393 from naturallaw777/fix/path-injection-4334-4532 fix: add CodeQL-recognized path sanitization for domain_name	2026-08-07 13:51:28 -05:00
copilot-swe-agent[bot]andnaturallaw777	a32b353eda	fix: resolve merge conflict with origin/main in server.py Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>	2026-08-07 18:50:01 +00:00
naturallaw777	4555764d87	fix: add CodeQL-recognized path sanitization for domain_name	2026-08-07 13:44:26 -05:00